Trust

What the OurCVEs sensor does — and never does.

Installing anything on a production server deserves real scrutiny — especially when it talks to a company you just met. So here is the whole truth about our sensor, in plain language, before you paste a single install command.

The sensor is a small program that runs on the hosts you choose. Its only job is to enumerate the packages your operating system already knows are installed — the same data you would get from running dpkg, rpm, or your language's package manager — and report that inventory back to OurCVEs over HTTPS.

Once we have that inventory, we cross-reference it against the published CVE feeds and tell you when something you actually run is affected. That is the entire job.

What it does

Reads the package databases your OS already maintains.
Sends a list of package names and versions to OurCVEs over outbound HTTPS.
Notes whether a reboot is pending and whether unattended upgrades are enabled.
Re-checks on a schedule so we notice when you upgrade or patch.

What it never does

It does not contain an LLM and it does not "do" anything autonomously.
It does not execute code we send it. There is no remote-command channel.
It does not read your application source, environment variables, secrets, or user data.
It does not open any inbound ports. Communication is outbound HTTPS only.

Verify it yourself

Read every payload

Every host has a "last report" view in your dashboard. The exact inventory we received is right there for you to inspect — nothing is hidden behind the curtain.

Outbound-only, by design

There is no port to expose and no inbound connection to firewall. The sensor reaches out to us; nothing reaches in to it.

Uninstall in one line

The same one-liner that installs the sensor removes it. Changed your mind? You're never locked in.

Start for free See how the whole thing works